843 matches found
JVN#91502163: Direct Web Remoting (DWR) vulnerable to XML external entity injection
Direct Web Remoting DWR is a Java framework for developing Ajax into web applications. DWR contains an XML external entity injection vulnerability CWE-611. Impact When an application uses a function to convert DOM data DOMConverter, JDOMConverter, DOM4JConverter or XOMConverter and a specially...
SEC Consult SA-20140710-0 :: Multiple critical vulnerabilities in Shopizer webshop
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140710-0 ======================================================================= title: Multiple critical vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed...
Dlink DWR-113 Rev. Ax - CSRF Denial of Service
No description provided by source. Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-13 Tested on : Windows 7 CVE :...
Dlink DWR-113 Rev. Ax - CSRF Denial of Service
It was observed that the D-link DWR-113 wireless router is vulnerable to denial of service attack via CSRFCross-Site Request Forgery vulnerability. An attacker could craft a malicious CSRF exploit to change the password in the password functionality when the useradmin is logged in to the...
D-Link DWR-113 Cross Site Request Forgery
Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-13 Tested on : Windows 7 CVE : CVE-2014-3136 Type of Application : Web...
D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery Denial of Service
D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery Denial of Service Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-...
D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service
Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-13 Tested on : Windows 7 CVE : CVE-2014-3136 Type of Application : Web...
Shopizer 1.1.5 Multiple Vulnerability
Shopizer version 1.1.5 suffers from remote command execution, cross site request forgery, cross site scripting, data manipulation , authorization bypass and hardcoded key vulnerabilities. title: Multiple critical vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and...
CVE-2013-4093
The SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote attackers to obtain sensitive information via 1 a direct request to dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr, which reveals the installation path in the s0.filePath...
PT-2013-4846
Name of the Vulnerable Software and Affected Versions Imperva SecureSphere version 9.0.0.5 Description The issue allows remote attackers to obtain sensitive information. This can be achieved through a direct request to "dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr", which...
CVE-2013-4093: Improper Limitation of a Pathname to a Restricted Directory
The SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote attackers to obtain sensitive information via 1 a direct request to dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr, which reveals the installation path in the s0.filePath...
CSRF attack message thrown when JSESSIONID is changed
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-15779. panel Symptoms: Anything that is using DWR will fail. Meaning: page editor is fully or partially unusable and it may...
CSRF attack message thrown when JSESSIONID is changed
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-15779. panel Symptoms: Anything that is using DWR will fail. Meaning: page editor is fully or partially unusable and it may...
CSRF attack message thrown when JSESSIONID is changed
Symptoms: Anything that is using DWR will fail. Meaning: page editor is fully or partially unusable and it may display the text "Draft saving timed out" on top of the text area. At the same time, the following error messages are printed in the Confluence log: noformat 2009-05-15 08:06:36,011 ERRO...
Atlassian JIRA < 3.13.3 DWR 'c0-id' XSS
The Atlassian JIRA installation hosted on the remote web server is affected by a cross-site scripting XSS vulnerability due to a failure to sanitize input to the 'c0-id' parameter during a DWR call. A remote attacker, using a crafted URL, can exploit this to execute JavaScript in a user's browser...
XSS in DWR
Confluence still uses DWR 1.1.4. This version contains a Cross Site Scripting Vulnerability in the handling of error messages. Example...
XSS in DWR
Confluence still uses DWR 1.1.4. This version contains a Cross Site Scripting Vulnerability in the handling of error messages. Example...
XSS in DWR
Confluence still uses DWR 1.1.4. This version contains a Cross Site Scripting Vulnerability in the handling of error messages. Example...